Fix vulns in dev deps with npm audit fix

node_modules/uglify-js/lib/scope.js

@@ -55,6 +55,7 @@ function SymbolDef(scope, orig, init) {
     this.mangled_name = null;
     this.undeclared = false;
     this.id = SymbolDef.next_id++;
+    this.lambda = orig instanceof AST_SymbolLambda;
 }
 
 SymbolDef.next_id = 1;
@@ -191,13 +192,21 @@ AST_Toplevel.DEFMETHOD("figure_out_scope", function(options) {
     // pass 3: fix up any scoping issue with IE8
     if (options.ie8) self.walk(new TreeWalker(function(node) {
         if (node instanceof AST_SymbolCatch) {
-            redefine(node, node.thedef.defun);
+            var scope = node.thedef.defun;
+            if (scope.name instanceof AST_SymbolLambda && scope.name.name == node.name) {
+                scope = scope.parent_scope.resolve();
+            }
+            redefine(node, scope);
             return true;
         }
         if (node instanceof AST_SymbolLambda) {
             var def = node.thedef;
-            redefine(node, node.scope.parent_scope);
-            node.thedef.init = def.init;
+            redefine(node, node.scope.parent_scope.resolve());
+            if (typeof node.thedef.init !== "undefined") {
+                node.thedef.init = false;
+            } else if (def.init) {
+                node.thedef.init = def.init;
+            }
             return true;
         }
     }));
@@ -205,11 +214,19 @@ AST_Toplevel.DEFMETHOD("figure_out_scope", function(options) {
     function redefine(node, scope) {
         var name = node.name;
         var old_def = node.thedef;
-        var new_def = scope.find_variable(name) || self.globals.get(name) || scope.def_variable(node);
+        var new_def = scope.find_variable(name);
+        if (new_def) {
+            var redef;
+            while (redef = new_def.redefined()) new_def = redef;
+        } else {
+            new_def = self.globals.get(name) || scope.def_variable(node);
+        }
         old_def.orig.concat(old_def.references).forEach(function(node) {
             node.thedef = new_def;
             node.reference(options);
         });
+        if (old_def.lambda) new_def.lambda = true;
+        if (new_def.undeclared) self.variables.set(name, new_def);
     }
 });
 
@@ -281,9 +298,7 @@ AST_Scope.DEFMETHOD("def_variable", function(symbol, init) {
     var def = this.variables.get(symbol.name);
     if (def) {
         def.orig.push(symbol);
-        if (def.init && (def.scope !== symbol.scope || def.init instanceof AST_Function)) {
-            def.init = init;
-        }
+        if (def.init instanceof AST_Function) def.init = init;
     } else {
         def = new SymbolDef(this, symbol, init);
         this.variables.set(symbol.name, def);
@@ -413,7 +428,9 @@ AST_Toplevel.DEFMETHOD("mangle_names", function(options) {
             if (options.cache && node instanceof AST_Toplevel) {
                 node.globals.each(mangle);
             }
-            node.variables.each(mangle);
+            node.variables.each(function(def) {
+                if (!defer_redef(def)) mangle(def);
+            });
             return true;
         }
         if (node instanceof AST_Label) {
@@ -426,22 +443,11 @@ AST_Toplevel.DEFMETHOD("mangle_names", function(options) {
         }
         if (!options.ie8 && node instanceof AST_Catch) {
             var def = node.argname.definition();
-            var redef = def.redefined();
-            if (redef) {
-                redefined.push(def);
-                reference(node.argname);
-                def.references.forEach(reference);
-            }
+            var redef = defer_redef(def, node.argname);
             descend();
             if (!redef) mangle(def);
             return true;
         }
-
-        function reference(sym) {
-            sym.thedef = redef;
-            sym.reference(options);
-            sym.thedef = def;
-        }
     });
     this.walk(tw);
     redefined.forEach(mangle);
@@ -450,6 +456,21 @@ AST_Toplevel.DEFMETHOD("mangle_names", function(options) {
         if (options.reserved.has[def.name]) return;
         def.mangle(options);
     }
+
+    function defer_redef(def, node) {
+        var redef = def.redefined();
+        if (!redef) return false;
+        redefined.push(def);
+        def.references.forEach(reference);
+        if (node) reference(node);
+        return true;
+
+        function reference(sym) {
+            sym.thedef = redef;
+            sym.reference(options);
+            sym.thedef = def;
+        }
+    }
 });
 
 AST_Toplevel.DEFMETHOD("find_colliding_names", function(options) {
@@ -499,13 +520,14 @@ AST_Toplevel.DEFMETHOD("expand_names", function(options) {
         if (def.global && options.cache) return;
         if (def.unmangleable(options)) return;
         if (options.reserved.has[def.name]) return;
-        var d = def.redefined();
-        def.name = d ? d.name : next_name();
+        var redef = def.redefined();
+        var name = redef ? redef.rename || redef.name : next_name();
+        def.rename = name;
         def.orig.forEach(function(sym) {
-            sym.name = def.name;
+            sym.name = name;
         });
         def.references.forEach(function(sym) {
-            sym.name = def.name;
+            sym.name = name;
         });
     }
 });